Privacy Policy

RollSummary is an AI tool for tabletop role-playing games: you upload a recording of a game session and we transcribe it, summarize it, and help you keep organized campaign notes. This Privacy Policy explains what information RollSummary Inc. (RollSummary, we, us, or our) collects when you use the service at rollsummary.com (the Service), how we use it, who we share it with, and the choices and rights you have.

Because the Service processes audio recordings of your game sessions and sends them to third-party AI providers, we have written the sections on session recordings and AI processing and the providers we share data with in plain language. Please read them.

By using the Service you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Information you provide

• Account information. Your name and email address. If you register with a password, we store it in hashed form; we never store it in plain text. If you sign in with Google, we receive your basic Google profile (name, email, and profile image).
• Session recordings. The audio files you upload for transcription and summarization.
• Content you create. Transcripts, summaries and recaps, campaigns, notes, characters, NPCs and locations, community posts and reactions, and any images you upload.
• Payment information. When you subscribe or buy a token pack, our payment processor (Stripe) collects and processes your payment details. We do not receive or store your full card number. We store only your Stripe customer identifier and your subscription and plan status.
• Communications. Anything you send us when you contact support or request help.

Information collected automatically

• Usage data. How you interact with the Service: for example, pages viewed, features used, sessions created, and the approximate cost and volume of AI usage on your account.
• Device and connection data. Your IP address, browser and device type, operating system, and timestamps.
• Cookies and similar technologies. See Cookies below.

Turning your session audio into a transcript and summary is the core of the Service, and it involves sending your content to third-party AI providers. Here is exactly what happens:

• When you upload a recording, we store the audio file in our object storage (Cloudflare R2).
• To create a transcript, we make the audio available to our speech-to-text provider (Deepgram), which converts it into text.
• To generate summaries, recaps, and note assistance, we send the resulting transcript (and note text you create) to our AI providers (OpenAI and OpenRouter). We also create text embeddings of your notes so features like search and linking can work.
• Whether we keep your original recording after processing depends on the keep-session-audio option you choose when you create a session. If you do not opt in, we discard the stored recording once the transcript and summary have been produced. If you opt in, we retain it so you can play it back later, until you delete it or your account.

We do not sell your recordings, transcripts, or notes, and we do not use them to train our own models. Our transcription and AI providers process this content on our behalf to deliver the Service, under their own terms and data-protection commitments. AI-generated summaries can be inaccurate or incomplete. Please review them before relying on them.

• Provide the Service: transcribe, summarize, store, organize, and display your sessions, notes, and campaigns.
• Create and manage your account and authenticate you.
• Process payments, manage subscriptions, and track token allowances and usage.
• Send transactional email such as email verification, password resets, and account-related notices.
• Monitor, secure, troubleshoot, analyze, and improve the Service.
• Communicate with you about updates or features, where permitted, and respond to your requests.
• Comply with legal obligations and enforce our terms.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR:

• Performance of a contract: to provide the Service you sign up for, including transcription and summarization.
• Legitimate interests: to secure, analyze, and improve the Service, where those interests are not overridden by your rights.
• Consent: where required, for example for non-essential cookies or optional communications. You may withdraw consent at any time.
• Legal obligation: to comply with applicable law.

We use a small number of cookies and similar technologies:

• Essential cookies. A secure, HTTP-only session cookie (better-auth.session_token) keeps you signed in. The Service does not work without it.
• Analytics. We use PostHog and Vercel Analytics to understand usage and performance so we can improve the Service. These may set first-party identifiers.
• Session recording. We may record how you navigate the Service (pages viewed, clicks, scrolling, and screen size) so we can find and fix confusing or broken flows. Recordings are captured by PostHog. What you type into forms is masked, and the contents of your notes are masked, so they are not readable in a recording. We do not record your session audio or transcripts this way, and recordings are deleted after one month.

You can control or delete cookies through your browser settings, though disabling essential cookies will prevent you from signing in. We do not use cookies for cross-context behavioral advertising.

We do not sell your personal information. We share it only with the service providers (sub-processors) that help us run RollSummary, and only as needed to provide the Service:

• Cloudflare (R2): stores the session audio and images you upload.
• Deepgram: converts your session audio into text (speech-to-text).
• OpenAI and OpenRouter: generate summaries, recaps, note assistance, and search embeddings from your transcripts and notes.
• Stripe: processes payments and manages subscriptions. Stripe handles your card details; we do not.
• Trigger.dev: runs the background jobs that transcribe and summarize your sessions.
• Resend: sends transactional email (verification, password reset, and account notices).
• PostHog: product analytics and session recordings.
• Vercel and Railway: host the website, the application backend, and the database.
• Google: authenticates you and supplies your basic profile if you choose to sign in with Google.

We may also disclose information to comply with the law or a valid legal request, to protect the rights, safety, and property of RollSummary and others, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy.

We keep your account and content for as long as your account is active. Session recordings are kept according to the keep-session-audio option you choose, as described above. When you delete content or your account, we delete the associated personal data from our active systems, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Residual copies may persist in backups for a limited period before being overwritten. Usage and analytics data is generally retained for a shorter period.

We use commercially reasonable safeguards to protect your information, including encryption in transit (HTTPS/TLS), access controls, and hashed passwords. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us at julio@rollsummary.com.

RollSummary is operated from Canada, and our service providers are located in the United States and other countries. When we transfer your information across borders, the data-protection laws of the destination may differ from those where you live. Where required, we rely on appropriate safeguards (such as standard contractual clauses) to protect your information.

EEA, UK, and Switzerland (GDPR)

Subject to applicable law, you have the right to access, correct, delete, or port your personal data; to restrict or object to certain processing; and to withdraw consent. You may also lodge a complaint with your local supervisory authority.

California (CCPA/CPRA)

Subject to applicable law, you have the right to know what personal information we collect and how we use it, to request access and deletion, to correct inaccurate information, and to not be discriminated against for exercising your rights. We do not sell or share your personal information as those terms are defined by the CCPA.

How to exercise your rights

You can manage much of this yourself: in your account settings you can update your name, change your password, and delete your account, which removes your associated data. For anything else (including access and portability requests), email us at julio@rollsummary.com. We will respond within the timeframe required by applicable law.

The Service is intended for adults. You must be at least 18 years old to use RollSummary, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

The Service may contain links to sites and services we do not operate. We are not responsible for their content or privacy practices, and we encourage you to review the privacy policy of any site you visit.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice such as an email or an in-app message. Your continued use of the Service after an update means you accept the revised policy.

If you have questions about this Privacy Policy or how we handle your information, contact us:

• By email: julio@rollsummary.com
• RollSummary Inc., 7014 Dunrobin Way, Mississauga, ON L5N 6Y4, Canada

See also our Terms of Service.